Loading malware…
RustyBuer is a Rust-based rewrite of the Buer malware family designed to preserve compatibility with existing Buer command-and-control infrastructure while improving evasion against detections focused on earlier C-based builds. It functions primarily as a first-stage malware-as-a-service loader or downloader used to establish an initial foothold on Windows systems and retrieve additional payloads. Observed follow-on payloads have included Cobalt Strike Beacon, and Buer operators have been assessed in some cases to support access-as-a-service activity by selling or transferring compromised access to other threat actors. RustyBuer has also been discussed in reporting on tooling associated with actors linked to the TrickBot ecosystem.
Observed delivery has relied on phishing campaigns themed as shipping notices, with victims lured to malicious Microsoft Office documents. Infection required user interaction to enable macro execution, after which the document dropped and launched the Rust-based payload. Campaigns used a Windows Shell DLL application-bypass technique involving trusted system components to reduce endpoint detection opportunities, and persistence was established through startup shortcut creation.
RustyBuer includes anti-analysis and regional filtering logic. Documented behavior includes virtual-machine checks and locale checks intended to avoid execution in certain CIS environments. During beaconing, the malware collects host profiling data such as operating system version, architecture, privilege level, computer and user context, processor information, disk usage, and Active Directory domain details, then transmits this information to its controllers over HTTP(S). Server responses can instruct the malware to download and execute additional payloads.
Campaigns distributing RustyBuer affected organizations across a wide range of industry verticals, consistent with its role as broadly distributed initial-access malware rather than sector-specific tooling.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...after the discovery of NimRod/Nimza and RustyBuer which are both being leveraged by actors associated with the TrickBot crew.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
A notable aspect of Buer Loader’s arrival is its use of malicious Microsoft Word and Microsoft Excel documents containing an embedded VBA macro that creates a process via WMI.
The C2 functions are handled via HTTP(S) POST requests.
Further inspection of the command being executed by cmd.exe shows the full base64 command.
the macro function itself is obfuscated using Hex-encoded strings that must be concatenated, reordered, and decoded.
It is observed that a signed XLL file delivers Buer Loader.
This macro leveraged an Application Bypass (Windows Shell DLL via LOLBAS) to evade detection from endpoint security mechanisms. Example Script execution: rundll32.exe shell32.dll,ShellExec_RunDLL C:\ProgramData\OfficeSignCheck.exe
A Rust crate ... is used to retrieve system information that is to be sent in an HTTP POST request to the C&C.
Another functionality that this loader contains is to enumerate processes or threads and query a list of all running processes by using CreateToolhelp32Snapshot and ProcessInformation.
These requests contain encrypted system information from the infected machine.
One such functionality is to query local or system time, or GetSystemTimeAsFileTime as seen in Figure 13.
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
First-stage downloader/loader written in Rust (mentioned as another Rust-based malware family).
A Rust-rewritten variant of the Buer downloader mentioned as an example of threat actors rewriting older malware in modern languages to evade detection and hinder analysis.
Rust-based malware-as-a-service mentioned as background context for malware developers adopting Rust.
A malware loader referenced as part of earlier tracking and described as being leveraged by actors associated with the TrickBot crew.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.